<?php

/**
 * Secure Coding Report — KiyoHR
 */

return [
    'patterns_fixed' => [
        'Privileged mass assignment removed from User/Company fillable',
        'API permission fail-closed for named api.* routes',
        'Policy authorization on Leave API CRUD',
        'Private local disk for HR documents/resumes/leave/announcements/imports',
        'MIME allow-lists on employee documents and leave attachments; zip removed from announcements',
        'SecurityHeaders middleware globally appended',
        'Password reset uses hashed cast without double Hash::make',
        'VirusScanner contract with NullVirusScanner default',
    ],
    'patterns_remaining' => [
        'Many controllers still use inline validate() instead of Form Requests',
        'Some web FK exists: rules still lack company_id where clauses',
        'Spatie permission package unused',
        'Email verification not MustVerifyEmail',
    ],
    'laravel_12_practices' => [
        'bootstrap/app.php middleware aliases + append SecurityHeaders',
        'Sanctum statefulApi retained for SPA',
        'RateLimiter::for api / face-attendance',
    ],
];